SYSTEMS AND/OR METHODS FOR FORECASTING FUTURE BEHAVIOR OF EVENT STREAMS IN COMPLEX EVENT PROCESSING (CEP) ENVIRONMENTS

• US 20130046725A1
• Filed: 08/15/2011
• Published: 02/21/2013
• Est. Priority Date: 08/15/2011
• Status: Active Grant

• Current Assignee: Software AG
• Original Assignee: Software AG
• Inventors: CAMMERT, Michael, HEINZ, Christoph, RIEMENSCHNEIDER, Tobias, KRMER, Jrgen
• Granted Patent: US 9,286,354 B2
• Time in Patent Office: Days
• US Class Current: 706/52
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: G06N 5/00 Computing arrangements using knowledge-based models

Abstract

Certain example embodiments described herein relate to forecasting the future behavior of event streams in Complex Event Processing (CEP) environments. For each received event in an event stream, a reference window indicative of a predefined temporal range during which the forecast is to be computed is updated so that the reference window ends with the received event, with the reference window moving with the event stream. Within this processing loop, when a forecasting update policy indicates that the forecast is to be updated based on the received event: a forecasting window indicative of a temporal range in which events are to be forecasted is updated; and while the time period of the forecasting window is not exceeded, (a) a next forecasted event is generated via at least one processor and (b) the next forecasted event is inserted into the forecast window; and the forecast window is published.

Claims

1. A method of forecasting how an event stream will behave in the future, the method comprising:

receiving an event stream including a plurality of events upon which a forecast is to be based; and

for each received event in the event stream;

updating a reference window indicative of a predefined temporal range during which the forecast is to be computed so that the reference window ends with the received event, the reference window moving with the event stream, and

when a forecasting update policy indicates that the forecast is to be updated based on the received event;

updating a forecasting window indicative of a temporal range in which events are to be forecasted; and

while the time period of the forecasting window is not exceeded, (a) generating via at least one processor a next forecasted event and (b) inserting the next forecasted event into the forecast window; and

publishing the forecast window.

2. The method of claim 1, wherein the reference window is a time-based window or a count-based window.

3. The method of claim 1, further comprising adjusting, in response to user input, the reference window to selectively emphasize either short-term or long-term stream tendencies in the event stream.

4. The method of claim 1, wherein the forecasting window is a time-based window or a count-based window.

5. The method of claim 1, wherein the forecasting update policy triggers an update upon a predefined number of events occurring or at a user-specified time interval.

6. The method of claim 1, wherein the forecasting of the next events comprises, for each forecasted next event:

calculating a data portion for the forecasted next event based on data portions of the events in the sliding reference window;

calculating a start timestamp for the forecasted next event; and

calculating an end timestamp for the forecasted next event.

7. The method of claim 6, wherein the start timestamp for the forecasted next event is calculated by adding to an immediately prior start timestamp an estimated distance to the next start timestamp.

8. The method of claim 7, wherein the estimated distance is based on distances from the reference window.

9. The method of claim 7, wherein the end timestamp for the forecasted next event is calculated by adding an estimated time interval length to the calculated start timestamp for the forecasted next event.

10. The method of claim 9, wherein the estimated time interval length is based on time interval lengths of events in the reference window.

11. The method of claim 6, wherein at least one forecasted next event is used in the forecasting of another forecasted next event forecasted to occur later in time.

12. The method of claim 1, wherein the forecasting of the next events is practiced in accordance with a predefined forecasting strategy, the forecasting strategy including at least one strategy selected from the group consisting of:

(a) repeating values from the events in the reference window in a forward or backward manner;

(b) randomly selecting values from the events in the reference window;

(c) applying a weighted or unweighted average to values from the events in the reference window;

(d) smoothing an incrementally computed weighted average of the next event and a last estimate in accordance with a smoothing parameter controlling the emphasis of recent events;

(e) performing density-based resampling; and

(f) combining the reference window with a set of one or more predefined historic reference windows.

13. The method of claim 12, further comprising adapting parameters of the selected forecasting strategy based on an assessment of predicted event accuracy.

14. The method of claim 12, further comprising applying a conjoint estimate to data portion, event inter-arrival time, and time interval length parameters.

15. The method of claim 1, further comprising:

applying a learning algorithm to the forecast; and

adjusting the temporal range of the reference window and/or the forecasting window in response to the learning algorithm.

16. The method of claim 1, further comprising compressing events in the reference window.

17. The method of claim 16, further comprising increasing the temporal range of the reference window,

wherein the compressing and the increasing are balanced so that forecasting quality increases at a rate faster than compressing introduces error.

18. The method of claim 1, further comprising displaying business data indicative of events in the event stream along with business data indicative of forecasted events.

19. The method of claim 1, further comprising displaying system management event data along with forecasted system management event data.

20. A complex event processing (CEP) system, comprising:

at least one processor;

a CEP engine under the control of at the least one processor; and

at least one input adapter configured to receive an event stream including events and feed event data for the events from the event stream to the CEP engine;

wherein the CEP engine comprises;

at least one operator configured to directly or indirectly receive and process the event data for subsequent, direct or indirect, output to a system management application of the CEP system and/or an event consuming application or component in communication with the CEP system,

at least one forecasting operator configured to directly or indirectly receive and process the at least one said event stream by;

(a) for each received event in the event stream;

updating a reference window indicative of a predefined temporal range during which the forecast is to be computed so that the reference window ends with the received event, the reference window moving with the event stream, and

when a forecasting update policy indicates that the forecast is to be updated based on the received event;

 

updating a forecasting window indicative of a temporal range in which events are to be forecasted; and

 

while the time period of the forecasting window is not exceeded, (i) generating via at least one processor a next forecasted event and (ii) inserting the next forecasted event into the forecast window; and

 

publishing the forecast window, and

(b) directly or indirectly output the forecast to the system management application of the CEP system and/or an external application or component.

21. A non-transitory computer readable storage medium tangibly storing instructions that, are executable by at least one processor of a complex event processing (CEP) system, so as to at least:

receive an event stream including a plurality of events upon which a forecast is to be based; and

for each received event in the event stream;

update a reference window indicative of a predefined temporal range during which the forecast is to be computed so that the reference window ends with the received event, the reference window moving with the event stream, and

when a forecasting update policy indicates that the forecast is to be updated based on the received event;

update a forecasting window indicative of a temporal range in which events are to be forecasted; and

while the time period of the forecasting window is not exceeded, (a) generate a next forecasted event and (b) insert the next forecasted event into the forecast window; and

publish the forecast window.